linux-kernel - Re: [next-20130227] kernel NULL pointer dereference [ watchdog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Feb 2013 16:56:27 +0100
From:	Sedat Dilek <sedat.dilek@...il.com>
To:	Tejun Heo <tj@...nel.org>
Cc:	Borislav Petkov <bp@...en8.de>, Wim Van Sebroeck <wim@...ana.be>,
	Ingo Molnar <mingo@...hat.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	linux-watchdog@...r.kernel.org, x86@...nel.org,
	LKML <linux-kernel@...r.kernel.org>,
	linux-next <linux-next@...r.kernel.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [next-20130227] kernel NULL pointer dereference [ watchdog | perf
 related ? ]

On Wed, Feb 27, 2013 at 4:07 PM, Tejun Heo <tj@...nel.org> wrote:
> Replying here too just in case.
>
> On Wed, Feb 27, 2013 at 02:08:40PM +0100, Sedat Dilek wrote:
>> >> static inline void *idr_find(struct idr *idr, int id)
>> >> {
>> >>         struct idr_layer *hint = rcu_dereference_raw(idr->hint);
>> >>     86d7:       48 8b 05 00 00 00 00    mov    0x0(%rip),%rax        # 86de <perf_init_event+0x2e>
>> >>                         86da: R_X86_64_PC32     .bss+0xfc
>> >>
>> >>         if ((id & ~IDR_MASK) == hint->prefix)
>> >>     86de:       89 f2                   mov    %esi,%edx
>> >>     86e0:       30 d2                   xor    %dl,%dl
>> >>     86e2:       3b 10                   cmp    (%rax),%edx              <--- trapping insn
>> >>     86e4:       74 4a                   je     8730 <perf_init_event+0x80>
>> >>                 return rcu_dereference_raw(hint->ary[id & IDR_MASK]);
>> >>
>> >>
>> >> So 'hint' is NULL as RAX above confirms and we're not supposed to deref
>> >> NULL things.
>> >>
>> >> Looking at 29cf29e1fbb875019713eb55cf27ec35f1e5fa5e, Tejun should
>> >> probably know. CCed.
>
> Fix was posted some days ago.
>
>   http://thread.gmane.org/gmane.linux.kernel.next/26213
>
> I got Andrew's patch added to -mm message a week ago.  Not sure why it
> still hasn't showed up.  Andrew, any ideas?
>

Hmm, I am not very amused to read all this, really.

If such fixes are around why aren't they applied quickly?

The mentioned culprit commit was not in next-20130219 means introduced
with next-20130220.

OK, I have seen the patch but hell where should I know it affected me.
Even more... Sasha Levin sent a similiar (incomplete) patch to LKML.
The one by Andy Shevchenko you referenced was not sent parallelly to
LKML (from [2] you can easily pick-up patches in mbox-format).
And we are again here why the hell has Linux-Next no patchwork-service?
I know I asked for it!
Here... Look for email in Gmail -> Choose Show original -> Cut-N-Paste
-> Save in a file -> ...
A bit useless wasted time.

NO, there is the original but no "-fix" for [1] in mmotm patch-collection!

Oh before I forget, the patch from Andy Shevchenko fixes the issue here!
Feel free to add any credits.

- Sedat -

[1] http://ozlabs.org/~akpm/mmotm/broken-out/idr-implement-lookup-hint.patch
[2] https://patchwork.kernel.org/project/LKML/list/

> Thanks.
>
> --
> tejun

View attachment "dmesg_3.8.0-next20130227-5-iniza-small.txt" of type "text/plain" (54343 bytes)

Download attachment "3.8.0-next20130227-5-iniza-small.patch" of type "application/octet-stream" (3028 bytes)